Advisories › FURUNO ELECTRIC CO.,LTD. › ICSA-26-237-07
FURUNO FA-50 Class B AIS Transponder: 2 CVEs, Critical 9.1
Summary
CISA reports 2 vulnerabilities in FURUNO ELECTRIC CO.,LTD. FURUNO FA-50 Class B AIS Transponder. Weakness types: Use of Hard-coded Credentials, Missing Authentication for Critical Function. Successful exploitation of these vulnerabilities could allow an attacker to alter device settings. Highest CVSS v3 score: 9.1 (Critical), exploitable over the network.
What to do: Act now: FURUNO ELECTRIC CO.,LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet.
At a glance
- Vendor
- FURUNO ELECTRIC CO.,LTD.
- Products
- FURUNO FA-50 Class B AIS Transponder
- CVEs
- CVE-2026-59769, CVE-2026-67578
- Highest CVSS v3
- 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Transportation Systems
- Deployed
- Worldwide
- Vendor HQ
- Japan
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-59769 | Use of Hard-coded Credentials | 9.1 | – | No | An attacker, who knows the credentials and has access to the in-vessel network to which the device is connected to, may operate the settings screen using that credentials to alter the settings of the device. |
| CVE-2026-67578 | Missing Authentication for Critical Function | 7.5 | – | No | Some configurations may be changed on the management screen without authentication. |
Affected products (1)
- FURUNO FA-50 Class B AIS Transponder: vers:all/*
Vendor fixes and mitigations (from advisory)
- Mitigation: FURUNO ELECTRIC CO.,LTD. notes that production of this product ended in October 2020, and software updates will no longer be provided. FURUNO recommends users do not connect the product directly to the internet. To prevent unauthorized access, the vessel on which the product is installed should be properly locked and managed.
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-237-07
- Machine-readable CSAF record
- https://www.furuno.co.jp/en/news/notice/notice_category.html?itemid=1857&dispmid=965
- https://jvn.jp/en/vu/JVNVU95422936/
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.